Replace the JavaScript client's legacy TSDX toolchain

## Enhancement Request

### Use Case

Contributors should be able to install, lint, build, and test the JavaScript client on the supported Node.js versions without relying on the legacy `tsdx@0.14.1` toolchain and its vulnerable transitive development dependencies.

This is a development-tooling concern, not a reported vulnerability in the published client. On the head of #59, the production dependency audit is clean:

```console
cd src/Finos.Fdc3.Backplane.Client.JS
npm audit --omit=dev
# found 0 vulnerabilities
```

The full development audit currently reports:

```console
npm audit
# 94 vulnerabilities (5 low, 35 moderate, 49 high, 5 critical)
```

`npm audit --json` identifies three direct development roots: `tsdx@0.14.1`, `semantic-release@19.0.5`, and `semantic-release-monorepo@7.0.5`. This issue is intentionally limited to replacing TSDX; the semantic-release upgrades can be handled separately. Historical context: #23 accepted several TSDX findings as development-only, and #9 introduced the original JavaScript CVE scan. #59 removes the obsolete allow-list while keeping production auditing clean.

### Proposed Work

- Replace `tsdx@0.14.1` with a maintained build, lint, and test setup compatible with the Node.js versions supported by #59.
- Preserve the package's current public entry points and generated artifacts (`dist/index.js` and `dist/index.d.ts`).
- Preserve the existing `npm run build` and `npm run lint` contributor workflows, and make `npm test` execute at least one real test instead of exiting with “No tests found”.
- Regenerate `package-lock.json` without the TSDX dependency tree.
- Update JavaScript CI to exercise lint, build, and tests on the supported Node.js matrix.
- Record the remaining full `npm audit` baseline after TSDX is removed; do not hide unrelated findings with broad overrides or `npm audit fix --force`.

### Acceptance Criteria

- `npm ci`, `npm run lint`, `npm run build`, and `npm test` pass on every supported Node.js version.
- The package still emits the expected CommonJS/ES module output and TypeScript declarations, with no unintended public API changes.
- `npm ls tsdx` shows that TSDX is no longer installed.
- `npm audit --omit=dev` continues to report zero production vulnerabilities.
- The before/after development-audit counts are included in the pull request, with remaining semantic-release findings clearly identified as out of scope.

### Reproduction

From the repository root on the head of #59:

```console
cd src/Finos.Fdc3.Backplane.Client.JS
npm ci
npm audit
npm audit --omit=dev
npm ls tsdx semantic-release semantic-release-monorepo
```

Start in src/Finos.Fdc3.Backplane.Client.JS by reviewing the existing npm workflows, package-lock.json, and the JavaScript CI configuration, then run npm ci, npm audit, and the current lint, build, and test commands. Replace the TSDX-based setup while preserving dist/index.js, dist/index.d.ts, the public entry points, and contributor scripts. Done means the supported Node.js matrix passes all commands, npm ls tsdx is empty, and production auditing remains clean.

Written by the indexing model from the issue text.